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BACKGROUND OF THE INVENTION 
The present invention relates generally to cryptographic protocols and, 
more particularly, to a time-stamping protocol for time-stamping digital 
documents. 

There are times when it is desirable to prove the existence of a document 
as of a particular date. For example, patent disputes concerning the inventorship 
of an invention often turn on who is able to produce corroborating documentary 
evidence dating their conception of the invention. A common procedure for 
dating records is to keep the records in a daily journal or notebook with each 
page sequentially numbered and dated. Another procedure for dating a record is 
to have the record witnessed by an uninterested or trusted party that can attest to 
the existence of the document. The increasing use of computers, however, 
makes these time-stamping methods obsolete. It is relatively easy to change the 
date-stamp added to a document by the computer when the document was 
created. Further, while it is difficult to alter a paper document without leaving 
some signs of tampering, digital records can be easily altered or revised without 
leaving any evidence of tampering. Therefore, people are less likely to trust a 
digital document than a paper document that has been time-stamped using 
conventional time-stamping procedures. 

To be trusted, a time-stamping procedure for digital documents should 
meet the following criteria: 
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1 . The data itself must be time-stamped, without any regard to the 
physical medium on which it resides. 

2. It must be impossible to change a single bit of the data without that 
change being apparent. 

3. It must be impossible to timestamp a document with a date and 
time different than the current date and time. 

One method for time-stamping a digital document would be to archive the 
document with a trusted escrow agent. In this case, the document originator 
sends a copy of the digital document to a trusted escrow agent. The escrow 
agent records the date and time that the document was received and retains a 
copy in his archives. Later, if a dispute arises over the date of the document, the 
document originator can contact the escrow agent who produces his copy of the 
document and verifies that it was received on a particular date. This time- 
stamping procedure has a number of drawbacks. First, the document originator 
must disclose the contents of the document to the escrow agent. Also, large 
documents take a relatively long period of time to transmit to the escrow agent 
and they require a large amount of data storage. 

An improvement of the escrow procedure is to use a hash of the 
document. Instead of sending the document to the escrow agent, the document 
originator hashes the document using a one-way hash algorithm and sends the 
generated hash value to the escrow agent. The escrow agent stores the hash 
value along with the date and time that it was received in his archives. Later the 
document originator can use the services of the escrow agent to prove the 
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existence of the document as of a particular date. The disputed document can 
be hashed and the resulting hash value can be compared to the hash value 
stored by the escrow agent in his archives for equality. If the hash values are 
equal, the document is presumed to be in existence as of the date associated 
with the stored hash value. One advantage of this method is that the document 
originator does not need to disclose the contents of the document to the escrow 
agent. 

The need to escrow the document or hash value can be eliminated by 
having a time stamping authority generate a certified time stamp receipt using a 
cryptographic signature scheme as taught in U.S. Pat. No. Re. 34,954 to Haber 
et al. and Fischer, U.S. Patent No. 5,001 ,752. In this case, the document 
originator hashes the document and transmits the hash value to the time 
stamping authority. The time stamping authority appends the current date and 
time to the hash value to create a time stamp receipt and digitally signs the time 
stamp receipt with a private signature key. The time stamping authority's public 
verification key is distributed and available to anyone interested in validating a 
time stamp receipt created by time stamping authority. The public verification 
key is typically stored in a public key certificate signed by a Certification Authority 
so that anyone desiring to validate the time stamp receipt with the public key can 
have confidence in the authenticity of the key. 
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SUMMARY OF THE INVENTION 
The present invention is a time-stamping protocol for time-stamping digital 
documents so that the date of the document can be verified. The method 
presumes the existence of a trusted agent referred to herein as the time- 
stamping authority (TSA). According to the present invention, the document 
originator creates a time stamp receipt by combining the document or other 
identifying data that can later serve as evidence of the substance of a document 
with a time indication. The document originator sends the time stamp receipt to a 
time stamping authority TSA. The TSA validates the time stamp receipt by 
comparing the time value specified in the submitted time stamp receipt with the 
current time derived from a trusted clock available to the TSA. If the time value 
specified in the time stamp receipt meets the time criteria established by the time 
stamping authority, the time stamping authority binds together the time value and 
document or other identifying data, e.g., by certifying the time stamp receipt R 
using a cryptographic signature scheme. For example, the time stamping 
authority may perform the binding operation (e.g., by certifying the time stamp 
receipt) where the date specified by the time stamp receipt equals the current 
date, or may perform the binding operation only on those records received within 
a predetermined time window. 

BRIEF DESCRIPTION OF THE DRAWINGS 
Figure 1 illustrates an illustrative embodiment of the time stamping method 
of the present invention. 
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DETAILED DESCRIPTION OF THE INVENTION 
Figure 1 is a flow diagram illustrating the general process of time-stamping 
a document according to the present invention. A document D is created at step 
1 00. The document D is presumed to be in digital form and may comprise any 
alphanumeric, audio, or graphic presentation of any length. The document D 
may optionally be hashed at step 102 using a one-way hashing function. A hash 
function is a function that takes a variable length input string, called a pre-image, 
and converts it to a fixed-length string, called a hash value, denoted H. The pre- 
image in this case is the document D or selected portions thereof. A one-way 
hash function operates in only one direction. While, it is easy to compute a hash 
value from the pre-image, it is computationally impractical to find a pre-image 
that hashes to a given hash value. Thus, it is practically impossible to recover 
the pre-image given the hash value and knowledge of the hash algorithm. 
Another feature of a hashing function is that it is difficult to find any two pre- 
images that hash to the same value. 

There are several advantages to sending a hash value H produced on 
document D instead of the document D itself. First, the hash value H improves 
security by functioning as a fingerprint of the document D. Changing a single bit 
in the document D will result in an entirely different hash value making it easy to 
detect efforts to modify a document D or hash value H. Second, the hash value 
H greatly reduces the amount of data that must be transmitted to the TSA. This 
factor can be important where the available bandwidth is limited. Third, by 
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sending a hash value H in place of the document D, the content of the document 
D does not need to be disclosed to the TSA. 

Any known hashing function, such as the SHA-1, MD5, and RIPEMD-160, 
can be used in the present invention. For the remaining description of the time 
stamping protocol, it will be assumed that the document D has been hashed and 
that the hash value H has been sent to the TSA in lieu of the document D. It is 
understood, however, that one can practice the invention by substituting D, 
selected portions of document D, or some other function of D in place of the hash 
value H in the protocol. 

The document originator generates a time stamp receipt R at step 104 by 
concatenating or otherwise combining identifying data associated with the 
document D with a time indication. The identifying data may be any digital data 
derived from or associated with the document D that can be used to identify the 
document D and may include a digital representation of the document D or 
selected portions thereof, or a digital sequence derived by application of some 
function (e.g. hash function) to the document D. In the disclosed embodiment, 
the identifying data comprises the hash value H generated on document D. 
Other optional data, such as the originator's identification number ID or a 
sequential record number SN, could also be used to generate the time stamp 
receipt R. The optional data could be provided by the document originator or by 
another party, such as the TSA. The time stamp receipt R is generated, for 
example, by concatenating the hash value H generated on document D with the 
current time T and optionally other data, such as the originator's ID number 
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and/or a sequential record number SN. The time stamp receipt R would, in this 
example, comprise the string (H, T, ID, SN). 

After creating the time stamp receipt R, the document originator transmits 
the time stamp receipt R and other optional data to a time stamping authority 
TSA at step 1 06. After receiving the time stamp receipt R, the TSA verifies the 
time stamp receipt R at step 108. First, the TSA verifies that the data in the time 
stamp receipt R is consistent with data maintained and controlled by the TSA. 
For example, the TSA may require, as part of its time stamping services, that the 
document originator provide its ID number and a sequential record number SN. 
In this case, the TSA would verify that the data submitted by the document 
originator is consistent with data maintained by the TSA. If, for example, the 
sequential record number SN was out of sequence, the TSA may refuse to 
perform the binding operation as described below. 

If the data in the submitted time stamp receipt R is consistent with data 
maintained by the TSA, the TSA then verifies the time value T specified in the 
time stamp receipt R. The time value T in the time stamp receipt R is compared 
against the current time T T sa obtained from a trusted clock maintained by the 
TSA. Alternatively, the current time T T sa can be obtained by the TSA from a 
trusted source. To be valid, the time value T specified in the time stamp receipt 
must be within a certain specified range of the current date and time established 
by the TSA. For example, the TSA may accept only those time stamp receipts 
where the specified date of the time stamp receipt R is equal to the current date. 
Alternatively, the TSA may specify a time window AT and accept only those time 
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stamp receipts submitted to the TSA (e.g., for certification) that fall within the 
specified time window AT from the current time T T sa- The TSA performs the 
binding operation (e.g., by certifying time stamp receipts) only on those time 
stamp receipts that meet the time criteria established by the TSA. Time stamp 
receipts submitted to the TSA that do not meet this time criteria are rejected. 

If the time stamp receipt R submitted by the document originator is 
determined to be valid at step 110, the TSA performs the binding operation at 
step 1 12 to cryptographically bind the identifying data, such as the hash value H, 
and time value T contained in the time stamp receipt R. One method for 
cryptographically binding the identifying data with the time value T is to sign the 
time stamp receipt with a private signature generation key K PR to generate a 
certified time stamp receipt, denoted sig(R). The signature generation key K PR is 
part of a public and private key pair (K P , K PR ) used by the TSA to certify time 
stamp receipts. The private key K PR is known only to the TSA. The public key K P 
is made available to the public so that anyone can verify or authenticate the 
TSA's signature. The public key K P can be stored in a certificate signed by a 
Certification Authority CA so that the TSA's public key can be validated and, 
hence, trusted by those using the public key K P . The time stamp receipt R can 
be signed using any known cryptographic signature scheme, such as a digital 
cryptographic signature scheme based on the RSA Algorithm. 

Those skilled in the art will appreciate that there are numerous other ways 
to perform the binding operation. Signing the time stamp receipt R with a 
signature generation key belonging to the TSA is just one way of binding the time 
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value T and identifying data. The binding operation could also be accomplished 
by computing a Message Authentication Code (MAC) on the time stamp receipt 
R (or selected portions of R) using a secret key K belonging to the TSA. One 
method for binding a time value T with a document D using a Message 
Authentication Code is described in a separate application file simultaneously 
with this application entitled Time Stamping Method Employing Separate Ticket 
and Stub/ which is incorporated herein by reference. The binding operation 
might also be accomplished by encrypting the time stamp receipt R or selected 
portions of R using a cryptographic key belonging to the TSA. Another way to 
perform the binding operation is to compute a hash value on the time receipt R or 
selected portions of R. These examples are not intended to be exhaustive, but 
are intended to illustrate some of the techniques that could be used to perform 
the binding operation. All that is required is that the binding operation establish a 
verifiable link between the time value T and the document D or some function of 
the document D. 

The binding operation produces binding information, denoted Binfo, which 
is transmitted to the originator at step 114. If the binding operation is performed 
by signing the time stamp receipt R, then the binding information Binfo consists 
of a digital signature generated on the time stamp receipt, denoted sig(R). If the 
binding operation comprises generation of the Message Authentication Code, 
encrypted value, hash value, or some other function, then the binding information 
Binfo would comprise the Message Authentication Code, encrypted value, hash 
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value, or other data generated. In this case the binding information would be 
transmitted to the document originator at step 114. 

In the event that a dispute arises concerning the validity of a document, 
the existence and substance of the document can be proved by means of the 
binding information Binfo- For example, consider the situation where B| NF o 
consists of a certified time stamp receipt sig(R). To verify the document D, the 
TSA's signature on the certified time stamp receipt sig(R) is verified using the 
TSA's public verification key K P . Next, the disputed document D is verified 
against the hash value H contained in the certified time stamp receipt sig(R) by 
generating a hash value H on the disputed document D and comparing the 
computed hash value H to the hash value contained in the time stamp receipt R 
for equality. The date or time of the document D is proved by the time value T in 
the certified time stamp receipt. 

Where the binding information comprises a Message Authentication code, 
encrypted value, or other data protected by a secret key, the document originator 
would need to obtain the aid of the TSA or a third party having access to the 
secret key to verify the document. 

The time-stamping procedures described herein may be implemented 
using general purpose programmable computers. A client program running on a 
user's computer could perform the steps of hashing documents, generating time 
stamp receipts, and transmitting time stamp receipts to the TSA. A server 
application running on a general purpose programmable computer controlled by 
the TSA could perform the steps of validating time stamp receipts, binding (e.g. 
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signing time stamp receipts) and transmitting binding information (e.g. signed 
time stamp receipts) to users. It would also be possible to implement some or all 
of the steps in firmware, or in hard-wired logic. 

The present invention may, of course, be carried out in other specific ways 
than those herein set forth without departing from the spirit and essential 
characteristics of the invention. The present embodiments are, therefore, to be 
considered in all respects as illustrative and not restrictive, and all changes 
coming within the meaning and equivalency range of the appended claims are 
intended to be embraced therein. 
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Claims: 



1 . A method for time stamping a document comprising: 

receiving a time stamp receipt at an outside agency, said time stamp 
receipt including identifying data associated with said document and a 
time indication; 

validating said time stamp receipt at said outside agency by comparing the 
time indication in said time stamp receipt to the current time; and 

if said time stamp receipt is valid, binding at said outside agency said 
identifying data and said time indication using a cryptographic binding 
scheme. 

2. The time stamping method of claim 1 further including transmitting said 
binding information to a designated party. 

3. The time stamping method of claim 1 wherein said identifying data comprises 
a digital representation of at least a portion of said document. 

4. The time stamping method of claim 3 wherein said identifying data comprises 
a digital sequence derived by application of a deterministic function to at least 
a portion of said document. 
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5. The time stamping method of claim 4 wherein said digital sequence is a hash 
value derived by application of a one-way hashing function to at least a 
portion of said document. 

6. The time stamping method of claim 1 wherein said time stamp receipt further 
includes an identification number associated with the document originator 

7. The time stamping method of claim 6 wherein said time stamp receipt further 
includes a sequential record number. 

8. The time stamping method of claim 7 wherein the step of validating said time 
stamp receipt includes comparing said identification number and sequential 
record number with data maintained by the outside agency. 

9. The time stamping method of claim 1 wherein said binding step includes 
signing a combination of said identifying data and said time indication using a 
digital cryptographic signature scheme. 

10. The time stamping method of claim 1 wherein said binding step includes 
computing a message authentication code on a combination of said 
identifying data and said time indication using a secret key controlled by said 
outside agency. 
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1 1 . The time stamping method of claim 1 wherein said binding step includes 
computing a hash value on a combination of said identifying data and said 
time indication. 

12. The time stamping method of claim 1 wherein said binding step includes 
encrypting a combination of said identifying data and said time indication 
using a secret key controlled by said outside agency. 

13. A method for time stamping a document comprising: 

creating a time stamp receipt including identifying data associated with 

said document and a time indication; 
transmitting said time stamp receipt to an outside agency; and 
cryptographically binding at said outside agency said identifying data and 

said time indication. 

14. The time stamping method of claim 13 wherein said identifying data 
comprises a digital representation of at least a portion of said document. 

15. The time stamping method of claim 13 wherein said identifying data 
comprises a digital sequence derived by application of a deterministic function 
to at least a portion of said document. 
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16. The time stamping method of claim 15 wherein said digital sequence is a 
hash value derived by application of a one-way hashing function to at least a 
portion of said document. 



17. The time stamping method of claim 13 wherein said time stamp receipt further 
includes an identification number associated with the document originator. 

18. The time stamping method of claim 14 wherein said time stamp receipt further 
includes a sequential record number. 

19. A method for time stamping a document comprising: 

creating a time stamp receipt including identifying data associated with 

said document and a time indication; 
transmitting said time stamp receipt to an outside agency; 
validating said time stamp receipt at said outside agency by comparing the 

time indication in said time stamp receipt to the current time; and 
if said time stamp receipt is valid, binding at said outside agency said 

identifying data and said time indication using a cryptographic binding 

scheme to generate a certified time stamp receipt. 

20. The time stamping method of claim 19 further including transmitting said 
binding information to a designated party. 
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21. The time stamping method of claim 19 wherein said identifying data 
comprises a digital representation of at least a portion of said document. 



22. The time stamping method of claim 21 wherein said identifying data 
comprises a digital sequence derived by application of a deterministic function 
to at least a portion of said document. 

23. The time stamping method of claim 22 wherein said digital sequence is a 
hash value derived by application of a one-way hashing function to at least a 
portion of said document. 

24. The time stamping method of claim 19 wherein said time stamp receipt further 
includes an identification number associated with the document originator 

25. The time stamping method of claim 24 wherein said time stamp receipt further 
includes a sequential record number. 

26. The time stamping method of claim 25 wherein the step of validating said time 
stamp receipt includes comparing said identification number and sequential 
record number with data maintained by the outside agency. 
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27. The time stamping method of claim 19 wherein said binding step includes 
signing a combination of said identifying data and said time indication using a 
digital cryptographic signature scheme. 

28. The time stamping method of claim 19 wherein said binding step includes 
computing a message authentication code on a combination of said 
identifying data and said time indication using a secret key controlled by said 
outside agency. 

29. The time stamping method of claim 19 wherein said binding step includes 
computing a hash value on a combination of said identifying data and said 
time indication. 

30. The time stamping method of claim 19 wherein said binding step includes 
encrypting a combination of said identifying data and said time indication 
using a secret key controlled by said outside agency. 
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ABSTRACT OF THE DISCLOSURE 
A method for time stamping a digital document is disclosed. The 
document originator creates a time stamp receipt using the document and the 
current time. The time stamp receipt is submitted to a time stamping authority 
having a trusted clock. The time stamping authority validates the time stamp 
receipt by comparing the time value specified in the time stamp receipt to the 
current time. If the time value specified in the time stamp receipt is within a 
predetermined time window, the time stamping authority cryptographically 
binds the time value and document, or the time value and some 
representation of the document, e.g., by signing the time stamp receipt with 
its private signature key. 
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